humocs-man/fluffy-pancake
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

.gitea/workflows/redhat_build.yml aktualisiert

Browse Source
This commit is contained in:
humocs-man
2026-08-09 19:14:50 +00:00
parent ba62f9dd50
commit 85916eb63e
1 changed files with 32 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/redhat_build.yml
+32 -33
View File
@@ -32,9 +32,7 @@ jobs:
- name: Prepare environment
run: |
# Extrahiert die reine Domain/Host aus der Gitea-URL
REGISTRY_HOST=$(echo "${{ github.server_url }}" | awk -F/ '{print $3}')
OWNER_LOWER="${{ github.repository_owner }}"
NAME_LOWER="${{ env.IMAGE_NAME }}"
@@ -42,6 +40,10 @@ jobs:
echo "IMAGE_REGISTRY=${REGISTRY_HOST}/${OWNER_LOWER,,}" >> "${GITHUB_ENV}"
echo "IMAGE_NAME=${NAME_LOWER,,}" >> "${GITHUB_ENV}"
# ------------------------------------------------------------
# Image tag
# ------------------------------------------------------------
- name: Determine image tag
run: |
BRANCH="${GITHUB_REF_NAME}"
@@ -59,7 +61,7 @@ jobs:
fi
# ------------------------------------------------------------
# Source
# Checkout
# ------------------------------------------------------------
- name: Checkout
@@ -114,21 +116,15 @@ jobs:
password: ${{ secrets.REGISTRY }}
# ------------------------------------------------------------
# Prepare OCI archive destination
# Prepare OCI output
# ------------------------------------------------------------
- name: Prepare OCI archive
run: |
# Wichtig:
# Falls aus einem vorherigen Lauf / Schritt ein Verzeichnis
# namens oci-layout.tar existiert, muss es weg.
rm -rf "${{ github.workspace }}/oci-layout.tar"
echo "OCI output path:"
echo "${{ github.workspace }}/oci-layout.tar"
# ------------------------------------------------------------
# Build
# Build image
# ------------------------------------------------------------
- name: Build Image (Docker Buildx OCI-Export)
@@ -147,13 +143,20 @@ jobs:
cache-from: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
cache-to: type=registry,ref=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
# Explizit ein OCI-TAR-Archiv erzeugen.
#
# tar=true ist absichtlich explizit gesetzt.
outputs: type=oci,dest=${{ github.workspace }}/oci-layout.tar,tar=true
# ------------------------------------------------------------
# Push using Skopeo
# Install Skopeo
# ------------------------------------------------------------
- name: Install Skopeo
if: github.event_name != 'pull_request'
run: |
sudo apt-get update
sudo apt-get install -y skopeo
# ------------------------------------------------------------
# Push image via Skopeo
# ------------------------------------------------------------
- name: Push Image via Skopeo (zstd:chunked)
@@ -163,20 +166,18 @@ jobs:
TAGS="${{ steps.metadata.outputs.tags }}"
for TAG in $TAGS; do
for TAG in $TAGS; do
echo "Pushe ${TAG} via Skopeo mit zstd:chunked..."
docker run --rm \
-v "${{ github.workspace }}:/workspace:ro" \
quay.io/skopeo/stable copy \
--dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
--dest-compress-format zstd:chunked \
oci-archive:/workspace/oci-layout.tar \
"docker://${TAG}"
skopeo copy \
--dest-creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
--dest-compress-format zstd:chunked \
"oci-archive:${{ github.workspace }}/oci-layout.tar" \
"docker://${TAG}"
done
# ------------------------------------------------------------
# Install dependencies for signing
# Install envsubst
# ------------------------------------------------------------
- name: Install envsubst dependencies
@@ -186,34 +187,34 @@ jobs:
sudo apt-get install -y gettext
# ------------------------------------------------------------
# Cosign
# Install Cosign
# ------------------------------------------------------------
- name: Install Cosign
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
uses: sigstore/cosign-installer@v4.1.2
# ------------------------------------------------------------
# Sign image
# ------------------------------------------------------------
- name: Sign container image (Recursive Digest)
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
env:
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
COSIGN_PASSWORD: ""
run: |
set -e
# 1. Cosign an der Gitea-Registry anmelden
echo "${{ secrets.REGISTRY }}" \
| cosign login "${{ env.REGISTRY_HOST }}" \
-u "${{ github.repository_owner }}" \
--password-stdin
# 2. Finalen Digest via Skopeo abfragen
echo "Frage finalen Registry-Digest via Skopeo ab..."
OUTER_DIGEST=$(
docker run --rm \
quay.io/skopeo/stable inspect \
skopeo inspect \
--creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
"docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:stable" \
| jq -r .Digest
@@ -221,13 +222,11 @@ jobs:
echo "Registry digest: ${OUTER_DIGEST}"
# 3. Digest-basierte Referenz bauen
IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${OUTER_DIGEST}"
echo "Signiere Image rekursiv:"
echo "${IMAGE_REF}"
# 4. Rekursive Signatur
cosign sign -y \
--key env://COSIGN_PRIVATE_KEY \
--recursive \
@@ -245,6 +244,6 @@ jobs:
run: |
echo "Räume temporäre Dateien und Buildx-Cache auf..."
rm -rf "${{ github.workspace }}/oci-layout.tar"
rm -f "${{ github.workspace }}/oci-layout.tar"
docker buildx prune -a -f || true